)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":20509,"name":"Daniel Castellanos","email":"luis.daniel.castellanos@intel.com","username":"lcastell"},"change_message_id":"f6baadf3bbe04224703926e4d5c877db76bfd18d","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Kenji Ishii \u003cken-ishii@sx.jp.nec.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-08-18 07:54:56 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix the issue that domain admin cannot manage own project, user and group correctly"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"At the moment, when a user who have a domain admin privilege logged in,"},{"line_number":10,"context_line":"this user cannot do some operations even though the user has a enough privilege."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ac06dbe_d048315e","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":83},"updated":"2016-08-19 20:47:22.000000000","message":"please shorten the commit title a bit more. something like: \u0027allow domain admin to manage own project/user/group correctly\u0027","commit_id":"82668835b8f9e50ed37221d9536c5e0429259d93"},{"author":{"_account_id":17172,"name":"Kenji Ishii","email":"ken-ishii@sx.jp.nec.com","username":"kenji-ishii"},"change_message_id":"05420929f974488b0fa90e989fddb8b16534f02b","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Kenji Ishii \u003cken-ishii@sx.jp.nec.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-08-18 07:54:56 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix the issue that domain admin cannot manage own project, user and group correctly"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"At the moment, when a user who have a domain admin privilege logged in,"},{"line_number":10,"context_line":"this user cannot do some operations even though the user has a enough privilege."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ac06dbe_53e8be10","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":83},"in_reply_to":"1ac06dbe_d048315e","updated":"2016-08-20 07:25:48.000000000","message":"Done","commit_id":"82668835b8f9e50ed37221d9536c5e0429259d93"},{"author":{"_account_id":20509,"name":"Daniel Castellanos","email":"luis.daniel.castellanos@intel.com","username":"lcastell"},"change_message_id":"f6baadf3bbe04224703926e4d5c877db76bfd18d","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix the issue that domain admin cannot manage own project, user and group correctly"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"At the moment, when a user who have a domain admin privilege logged in,"},{"line_number":10,"context_line":"this user cannot do some operations even though the user has a enough privilege."},{"line_number":11,"context_line":"(When we use domain scoped token, we assume that keystone v3 policy file"},{"line_number":12,"context_line":"(policy.v3cloudsample.json) is used.)"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ac06dbe_f0628dd7","line":9,"updated":"2016-08-19 20:47:22.000000000","message":"shorten lines in commit message under 72 characters","commit_id":"82668835b8f9e50ed37221d9536c5e0429259d93"},{"author":{"_account_id":17172,"name":"Kenji Ishii","email":"ken-ishii@sx.jp.nec.com","username":"kenji-ishii"},"change_message_id":"05420929f974488b0fa90e989fddb8b16534f02b","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Fix the issue that domain admin cannot manage own project, user and group correctly"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"At the moment, when a user who have a domain admin privilege logged in,"},{"line_number":10,"context_line":"this user cannot do some operations even though the user has a enough privilege."},{"line_number":11,"context_line":"(When we use domain scoped token, we assume that keystone v3 policy file"},{"line_number":12,"context_line":"(policy.v3cloudsample.json) is used.)"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ac06dbe_33e54237","line":9,"in_reply_to":"1ac06dbe_f0628dd7","updated":"2016-08-20 07:25:48.000000000","message":"Done","commit_id":"82668835b8f9e50ed37221d9536c5e0429259d93"}],"openstack_dashboard/dashboards/identity/groups/tables.py":[{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"4fe48c182f2a074ea6af1bc268ec4fb57834d0d7","unresolved":false,"context_lines":[{"line_number":80,"context_line":"    name \u003d \"delete\""},{"line_number":81,"context_line":"    # TODO(kenji-i): some policy of keystone v3 assume target\u0027s existence,"},{"line_number":82,"context_line":"    # we needs to consider better policy whether displaying this menu or not."},{"line_number":83,"context_line":"    policy_rules \u003d ((\"identity\", \"admin:required\"),)"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"    def allowed(self, request, datum):"},{"line_number":86,"context_line":"        return api.keystone.keystone_can_edit_group()"}],"source_content_type":"text/x-python","patch_set":3,"id":"bacf61ea_93b93b7c","line":83,"updated":"2016-07-29 20:00:45.000000000","message":"this seems like the incorrect fix, perhaps just adjusting so that the target is specified. Going to back to an admin check breaks the advantage RBAC controls introduced.","commit_id":"b8eb2fef3c2062805a52b87078ea2dd4be147083"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"4fe48c182f2a074ea6af1bc268ec4fb57834d0d7","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    def delete(self, request, obj_id):"},{"line_number":89,"context_line":"        target \u003d self.get_policy_target(request, obj_id)"},{"line_number":90,"context_line":"        if policy.check(((\"identity\", \"identity:delete_group\")),"},{"line_number":91,"context_line":"                        request, target\u003dtarget):"},{"line_number":92,"context_line":"            LOG.info(\u0027Deleting group \"%s\".\u0027 % obj_id)"},{"line_number":93,"context_line":"            api.keystone.group_delete(request, obj_id)"}],"source_content_type":"text/x-python","patch_set":3,"id":"bacf61ea_d37613d6","line":90,"updated":"2016-07-29 20:00:45.000000000","message":"These checks are too late to be useful other than saving the API round trip, but the user is already confused as to why they were shown a control that doesn\u0027t work.","commit_id":"b8eb2fef3c2062805a52b87078ea2dd4be147083"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":87,"context_line":"        api.keystone.group_delete(request, obj_id)"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":90,"context_line":"        if not datum:"},{"line_number":91,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id}"},{"line_number":92,"context_line":"        return super(DeleteGroupsAction, self). \\"},{"line_number":93,"context_line":"            get_policy_target(request, datum)"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_643e0d2b","line":90,"updated":"2017-02-16 20:13:40.000000000","message":"if datum is not None:","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":89,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":90,"context_line":"        if not datum:"},{"line_number":91,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id}"},{"line_number":92,"context_line":"        return super(DeleteGroupsAction, self). \\"},{"line_number":93,"context_line":"            get_policy_target(request, datum)"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_04647147","line":92,"updated":"2017-02-16 20:13:40.000000000","message":"Please don\u0027t use backslash for line continuation if you don\u0027t have to, it\u0027s dangerous.","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        # If the logon user was removed, redirect the user to logout."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":173,"context_line":"        if not datum:"},{"line_number":174,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id}"},{"line_number":175,"context_line":"        return super(RemoveMembers, self).get_policy_target(request, datum)"},{"line_number":176,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_445e6977","line":173,"updated":"2017-02-16 20:13:40.000000000","message":"if datum is not None:","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":258,"context_line":"        return reverse(self.success_url, args\u003d[group_id])"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":261,"context_line":"        if not datum:"},{"line_number":262,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id}"},{"line_number":263,"context_line":"        return super(AddMembers, self).get_policy_target(request, datum)"},{"line_number":264,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_64536d6d","line":261,"updated":"2017-02-16 20:13:40.000000000","message":"if datum is not None:","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"}],"openstack_dashboard/dashboards/identity/projects/tables.py":[{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"4fe48c182f2a074ea6af1bc268ec4fb57834d0d7","unresolved":false,"context_lines":[{"line_number":200,"context_line":"class DeleteTenantsTableAction(DeleteTenantsAction):"},{"line_number":201,"context_line":"    # TODO(kenji-i): some policy of keystone v3 assume target\u0027s existence,"},{"line_number":202,"context_line":"    # we needs to consider better policy whether displaying this menu or not."},{"line_number":203,"context_line":"    policy_rules \u003d ((\"identity\", \"admin_required\"),)"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    def delete(self, request, obj_id):"},{"line_number":206,"context_line":"        target \u003d self.get_policy_target(request, obj_id)"}],"source_content_type":"text/x-python","patch_set":3,"id":"bacf61ea_734c879e","line":203,"updated":"2016-07-29 20:00:45.000000000","message":"we don\u0027t want to reintroduce the flawed admin check, instead introduce the specifying the target.","commit_id":"b8eb2fef3c2062805a52b87078ea2dd4be147083"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"class DeleteTenantsTableAction(DeleteTenantsAction):"},{"line_number":201,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":202,"context_line":"        if not datum:"},{"line_number":203,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id}"},{"line_number":204,"context_line":"        return super(DeleteTenantsTableAction, self). \\"},{"line_number":205,"context_line":"            get_policy_target(request, datum)"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_24341549","line":202,"updated":"2017-02-16 20:13:40.000000000","message":"if datum is not None:","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"}],"openstack_dashboard/dashboards/identity/users/tables.py":[{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"4fe48c182f2a074ea6af1bc268ec4fb57834d0d7","unresolved":false,"context_lines":[{"line_number":161,"context_line":"class DeleteUsersTableAction(DeleteUsersAction):"},{"line_number":162,"context_line":"    # TODO(kenji-i): some policy of keystone v3 assume target\u0027s existence,"},{"line_number":163,"context_line":"    # we needs to consider better policy whether displaying this menu or not."},{"line_number":164,"context_line":"    policy_rules \u003d ((\"identity\", \"admin_required\"),)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"    def delete(self, request, obj_id):"},{"line_number":167,"context_line":"        user_obj \u003d self.table.get_object_by_id(obj_id)"}],"source_content_type":"text/x-python","patch_set":3,"id":"bacf61ea_8e0c743c","line":164,"updated":"2016-07-29 20:00:45.000000000","message":"no, here too. This check is flawed. Add a target specification. To do this for an action either add the target Mixin as a parent class, or add an allowed method that does the policy check instead of the policy_rules field","commit_id":"b8eb2fef3c2062805a52b87078ea2dd4be147083"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"4fe48c182f2a074ea6af1bc268ec4fb57834d0d7","unresolved":false,"context_lines":[{"line_number":166,"context_line":"    def delete(self, request, obj_id):"},{"line_number":167,"context_line":"        user_obj \u003d self.table.get_object_by_id(obj_id)"},{"line_number":168,"context_line":"        target \u003d self.get_policy_target(request, user_obj)"},{"line_number":169,"context_line":"        if policy.check(((\"identity\", \"identity:delete_user\")),"},{"line_number":170,"context_line":"                        request, target\u003dtarget):"},{"line_number":171,"context_line":"            api.keystone.user_delete(request, obj_id)"},{"line_number":172,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":3,"id":"bacf61ea_9315bb4a","line":169,"updated":"2016-07-29 20:00:45.000000000","message":"this check is too late to be very useful","commit_id":"b8eb2fef3c2062805a52b87078ea2dd4be147083"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":47,"context_line":"        return api.keystone.keystone_can_edit_user()"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":50,"context_line":"        if not datum:"},{"line_number":51,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id,"},{"line_number":52,"context_line":"                     \u0027tenant_id\u0027: request.user.project_id}"},{"line_number":53,"context_line":"        return super(CreateUserLink, self).get_policy_target(request, datum)"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_a4f1e597","line":50,"updated":"2017-02-16 20:13:40.000000000","message":"if datum is not None:\n\nThis way you can pass an empty dict if needed.","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"},{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        api.keystone.user_delete(request, obj_id)"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def get_policy_target(self, request, datum\u003dNone):"},{"line_number":173,"context_line":"        if not datum:"},{"line_number":174,"context_line":"            datum \u003d {\u0027domain_id\u0027: request.user.user_domain_id}"},{"line_number":175,"context_line":"        return super(DeleteUsersAction, self). \\"},{"line_number":176,"context_line":"            get_policy_target(request, datum)"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_e4291df4","line":173,"updated":"2017-02-16 20:13:40.000000000","message":"if datum is not None:","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"}],"openstack_dashboard/policy.py":[{"author":{"_account_id":8648,"name":"Radomir Dopieralski","email":"openstack@dopieralski.pl","username":"thesheep"},"change_message_id":"09b67b0c4c915a521530a72a07d5f4ed325b97e5","unresolved":false,"context_lines":[{"line_number":50,"context_line":"        policy_target \u003d {}"},{"line_number":51,"context_line":"        for policy_attr, datum_attr in self.policy_target_attrs:"},{"line_number":52,"context_line":"            if datum:"},{"line_number":53,"context_line":"                if isinstance(datum, dict):"},{"line_number":54,"context_line":"                    policy_target[policy_attr] \u003d \\"},{"line_number":55,"context_line":"                        datum.get(datum_attr, None)"},{"line_number":56,"context_line":"                else:"}],"source_content_type":"text/x-python","patch_set":14,"id":"fa31d9ce_4402e970","line":53,"updated":"2017-02-16 20:13:40.000000000","message":"I think you want to use collections.Mapping here https://docs.python.org/2.7/library/collections.html#collections.Mapping","commit_id":"9b3d7e9e4a8103bc453dcffb12ef31860504c1c9"}]}